Linux Kernel fs.protected_regular

這是 4.19 版才加入的安全性保護功能

protected_regular: This protection is similar to protected_fifos,
but it avoids writes to an attacker-controlled regular file,
where a program expected to create one.
When set to "0", writing to regular files is unrestricted.
When set to "1" don't allow O_CREAT open on regular files that we don't own in world writable sticky directories,
unless they are owned by the owner of the directory.
When set to "2" it also applies to group writable sticky directories.

RedHat 9 系的 Linux protected_regular 預設是 1
常見的目錄是 /tmp 及 /dev/shm
當目錄下面檔案 file owner 是 A，檔案權限是 -rw-rw-rw- (666) 當 B 去存取 file
有用到 O_CREAT 時，是不允許的，
但使用不同編輯器，編輯檔案後存檔，卻有不同樣的結果，
vim 編輯後可以寫入，nano 及 joe 都不能寫入，猜測跟檔案處理方式有關，vim 可能沒有調用 O_CREAT，所以可以寫入

Shell 的處理方式，例如以下動作也是可以，也就是沒有調用 O_CREAT
echo hello > file
echo world >> file

RedHat 要改這個預設值，是改這個檔
/usr/lib/sysctl.d/50-default.conf